CVE-2009-3094: Apache HTTP Server

Low severity, CVSS 2.6. EPSS: 8.6% chance of exploitation in the next 30 days.

The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.

Affected products

• Apache HTTP Server: from 2.0.35, before 2.0.64 (fixed in 2.0.64); from 2.2.0, before 2.2.14 (fixed in 2.2.14)
• Debian Debian Linux: version 4.0 only; version 5.0 only
• Fedoraproject Fedora: version 10 only; version 12 only

Published 2009-09-08. Last modified 2026-06-16.